1. Home
  2. Vulnerabilities
  3. CVE-2020-7021

CVE-2020-7021

CVSS v3.1 4.9 (Medium)
49% Progress
CVSS v2.0 4 (Medium)
40% Progress
EPSS 0.06 % (28th)
0.06% Progress
Affected Products 1
Advisories 1
Info CVSS EPSS CAPEC Affected Configurations References Security Advisories Packages & Software Tools, Exploits & PoC Graph Web & Social Timeline

Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch administrator to view these details.

Weaknesses
CWE-532
Insertion of Sensitive Information into Log File
CVE Status
PUBLISHED
CNA
Elastic
Published Date
2021-02-10 19:15:11
(3 years ago)
Updated Date
2021-03-26 12:49:51
(3 years ago)

Affected Products

Elastic

Configuration #1

    CPE23 From Up To
  Elasticsearch prior 6.8.14 version cpe:2.3:a:elastic:elasticsearch < 6.8.14
  Elasticsearch from 7.0.0 version and prior 7.10.0 version cpe:2.3:a:elastic:elasticsearch >= 7.0.0 < 7.10.0